Subject: [ipcdn] DEFVAL for docsBpi2CmtsCACertTrust

From: "Kaz Ozawa" <[email-masked]>
Date: Mon, 1 Apr 2002 12:18:18 -0700

While the bpiplus-05 specifies that DEFVAL for docsBpi2CmtsCACertTrust
is "chained", I am now wondering if this value is appropriate because
"chained" does not make sense when a docsBpi2CmtsCACertEntry for a
self-signed certificate is created by MIB.

When a CMTS learns the certificate in the Auth Info message from a CM, 
I believe the CMTS must set docsBpi2CmtsCACertTrust to 
(a) the value of docsBpi2CmtsDefaultSelfSignedManufCertTrust if the
certificate is self-signed, or
(b) "chained" if the certificate is not self-signed.

On the other hand, if a CMTS learns the certificate by any means except 
Auth Info message, I think the CMTS should set docsBpi2CmtsCACertTrust 
to "untrusted" unless the value is explicitly specified as "trusted",
"chained" or "root". I think another option for the CMTS is, by default, 
to set docsBpi2CmtsCACertTrust to "untrusted" if the certificate is 
self-signed or "chained" if the certificate is not self-signed.
But this option requires the CMTS to judge whether the certificate is 
self-signed or not. Therefore, I think it's simple and better to 
set the object to "untrusted" by default regardless of whether the
certificate is self-signed or not. 

If this makes sense, I think the DEFVAL should be "untrusted" instead 
of "chained".

Any comments?

Thanks,
kaz

_______________________________________________
IPCDN mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipcdn